PAM-SEN Practice Questions

In a CyberArk Distributed Vaults architecture, Satellite Vaults are primarily designed to provide high availability and load balancing for credential retrieval and session management. Therefore, the Password Vault Web Access (PVWA) and Privileged Session Manager (PSM) can connect directly to Satellite Vaults to service user requests. The Central Policy Manager (CPM) requires read/write access to the database to manage and rotate credentials, so it must connect directly to the Primary Vault, not a Satellite Vault.

A. CPM requires read/write access and must connect to the Primary Vault. EPM and PTA do not connect to Satellite Vaults for standard PAM operations.

C. CPM cannot connect to a Satellite Vault because it requires read/write access to the Vault database to perform password changes.

D. CPM cannot connect to a Satellite Vault; it must connect to the Primary Vault for credential management tasks.

1. CyberArk Official Documentation: PAM Self-Hosted -> Architecture -> Distributed Vaults -> Components connecting to Distributed Vaults.

2. CyberArk Official Documentation: PAM Self-Hosted -> Installation -> Installing Distributed Vaults -> Distributed Vaults Architecture.

The Vault Installation Wizard prompts for the Master CD (containing the server keys needed to encrypt and initialize the Vault) and the License file (to activate the Vault with the appropriate entitlements). These two are mandatory inputs the wizard requests to complete a fresh Vault installation. The Operator CD, by contrast, is used for ongoing operational activities after install and is not the file the wizard requests at install time.

A. Operator CD and License — The Operator CD is for post-install operations, not the install wizard; the Master CD is required at installation.

C. Operator CD and Vault Certificate — Neither is the correct pairing; the wizard needs the Master CD and License, not the Operator CD.

D. Master CD and DBparm.ini — DBparm.ini is a configuration file created/edited during setup, not a file the wizard prompts you to supply.

Important Note on Sources

I must be transparent per your source-integrity requirements: I cannot verify exact page numbers or section identifiers from the official CyberArk documentation without access to the live, versioned documents, and I will not fabricate citations. The appropriate authoritative sources to confirm this answer are:

- CyberArk Privileged Access Security Installation Guide — "Installing the Vault Server / Running the Vault Installation Wizard" section (CyberArk official product documentation, docs.cyberark.com).

- CyberArk PAM Self-Hosted Installation documentation — sections describing the Master CD contents (server keys) and license file requirements.

I recommend verifying the specific section/page against the exact version of the CyberArk PAM Self-Hosted Installation Guide corresponding to your deployment, as the answer aligns with the standard documented install procedure.

Would you like me to elaborate on the contents of the Master CD versus the Operator CD to reinforce the distinction?

1. CyberArk Privileged Access Manager Documentation, "Installation" -> "Install the Digital Vault" -> "Install the Vault" (Details the Vault Installation Wizard prompts for the Operator CD and license.xml).

The password Reconcile process is designed to restore synchronization between the CyberArk Vault and the target system when the password stored in the Vault is unknown, lost, or no longer matches the target. It achieves this by using a separate, highly privileged "Reconcile Account" (such as a domain admin or root account) to forcefully reset the target account's password to a new, randomly generated value, thereby regaining management control without needing the target's current password.

Option A: Incorrect because testing if stored credentials are accurate and match the target system is the purpose of the "Verify" process, not Reconcile.

Option B: Incorrect because changing a password using the account's own known credentials is the purpose of the standard "Change" process.

Option D: Incorrect because while a new password is generated during reconciliation, the primary purpose is regaining control of lost/unknown credentials, not merely password generation.

1. CyberArk Official Documentation: Privileged Access Manager Self-Hosted -> "Password Management" -> "Reconcile Passwords".

2. CyberArk Official Documentation: Privileged Access Manager Self-Hosted -> "Account Management" -> "Reconcile Accounts".

To achieve fault tolerance and high availability for the Password Vault Web Access (PVWA) within a single data center, CyberArk recommends deploying two or more PVWA servers configured behind a load balancer. This active-active architecture ensures that if one PVWA server fails or requires maintenance, the load balancer will seamlessly redirect user traffic to the remaining available PVWA servers, effectively eliminating a single point of failure for web access.

B. PVWAs are deployed as independent, active-active web nodes behind a load balancer, not as a traditional cluster.

C. Deploying only one PVWA creates a single point of failure, which violates the requirement for fault tolerance.

D. PVWAs do not use clustering technology; they rely on load balancing across multiple independent servers.

1. CyberArk Privileged Access Manager Documentation, "High Availability and Load Balancing" -> "PVWA Load Balancing" section.

To successfully install the Central Policy Manager (CPM), the Vault user performing the installation must possess specific administrative authorizations in the Vault. According to official CyberArk installation guidelines, these mandatory authorizations include Add Safes, Add/Update Users, Reset Users' Passwords, Manage Server File Categories, and Audit Users. These permissions allow the installation process to create the necessary CPM environment, including the CPM user, required Safes (such as PasswordManagerShared), and appropriate audit configurations.

A. Manage Directory Mapping is used for LDAP integration, not for installing the CPM component.

B. Activate Users is required to reactivate suspended users, which is not a prerequisite for the CPM installation process.

C. Backup All Safes and Restore All Safes are authorizations meant for backup users, not for component installation.

1. CyberArk Privileged Access Manager Documentation, "Install CPM" -> "Vault user authorizations" section.

In PSM for SSH (PSMP) Integrated mode, the standard OpenSSH daemon (sshd) is used alongside a PAM module to intercept privileged sessions. To add an additional maintenance user who can bypass the PSMP shell and access the host directly, you must create a local user on the Linux system and add this user to the group explicitly defined in the AllowGroups parameter within the /etc/ssh/sshdconfig file.

A: There is no default "PSMMaintenance Group" that automatically bypasses PSMP without being explicitly defined in the sshdconfig file.

B: proxymng is the default maintenance user created during installation, not the method for adding an additional user.

D: Creating a user named psmpmng does not automatically grant maintenance bypass rights; SSHD configuration is strictly required.

1. CyberArk Privileged Access Manager Documentation, "PSM for SSH Maintenance Users" (Integrated Mode configuration steps).

2. CyberArk Official Documentation, "Install PSM for SSH (Integrated mode)" (Version 12.x/13.x).

To enforce Two-Factor Authentication (2FA) across both the Password Vault Web Access (PVWA) and the PrivateArk Client, RADIUS must be utilized. The PrivateArk Client natively supports CyberArk, LDAP, RADIUS, and PKI authentication, but it does not support SAML (which is strictly web-based). Because LDAP and CyberArk authentication are single-factor by default, RADIUS is the required method to enforce 2FA for both interfaces simultaneously.

B: CyberArk authentication is a local, single-factor method and does not natively enforce 2FA.

C: SAML is not supported by the PrivateArk Client, and CyberArk authentication is single-factor.

D: SAML is strictly web-based and unsupported by the PrivateArk Client, making it impossible to use for both interfaces.

1. CyberArk Privileged Access Manager Administration Guide, "Authentication Methods" and "PrivateArk Client Authentication" sections.

2. CyberArk Official Documentation, "Configure RADIUS Authentication" (Version 12.x/13.x).

In CyberArk, a transparent user (an LDAP/Active Directory user) is provisioned in the Vault database only upon their first successful authentication. When the user logs in for the first time, the Vault evaluates the configured Directory Maps, authenticates the user against the external LDAP directory, and then automatically creates the corresponding user object in the Vault. During this initial login, the Vault also assigns the appropriate authorizations and group memberships based on the mapping rules.

A: Creating a directory mapping only establishes the rules for provisioning; it does not create the user accounts immediately.

B: The LDAP configuration wizard sets up the integration but does not provision individual user accounts.

D: The nightly LDAP refresh updates group memberships and user details for existing transparent users, but does not provision new users who haven't logged in.

CyberArk Privileged Access Manager Documentation, "User Management", Section: Transparent User Provisioning.

CyberArk Privileged Access Manager Documentation, "LDAP Integration", Section: Directory Mapping and User Authentication.

CyberArk Privileged Access Manager (PAM) natively supports a comprehensive suite of authentication methods to secure access to the Vault and its interfaces. These officially supported methods include CyberArk's native password authentication (SRP), LDAP integration for directory services, SAML for federated Single Sign-On (SSO), PKI for smartcard and certificate-based authentication, RADIUS for multi-factor authentication, and Oracle SSO. These methods allow organizations to align Vault access with their enterprise identity and access management (IAM) strategies. Biometric authentication is not a direct, native Vault authentication method.

G. Biometric: This is not natively supported as a direct Vault authentication method; biometric verification must be delegated to a third-party Identity Provider (IdP) integrated via SAML or OIDC.

1. CyberArk Privileged Access Manager Administration Guide, Section: "Authentication Methods" (Details native support for LDAP, RADIUS, PKI, SAML, Oracle SSO, and CyberArk authentication).

2. CyberArk PAM Installation Guide, Section: "Vault Authentication Configuration".

The CyberArk Digital Vault does not use a "modified version" of the Microsoft Windows Firewall. Instead, it utilizes the native, unmodified Windows Defender Firewall provided by the Windows Server operating system. The Vault service dynamically manages and configures the rules of this native firewall based on the parameters defined in the DBParm.ini configuration file. The firewall software itself remains the standard Microsoft executable.

[True] is incorrect because claiming the Vault uses a "modified version" misrepresents the Vault's architecture. CyberArk relies on the native OS capabilities for network filtering and does not alter the underlying Microsoft firewall binaries or services.

1. CyberArk Privileged Access Manager Documentation: "Security Fundamentals -> Vault Hardening -> Windows Firewall."

2. CyberArk Privileged Access Manager Documentation: "Administration -> Reference -> DBParm.ini."